Wscript/Cscript Chunked Download via MSXML2.XMLHTTP and ADODB.Stream to Temp/AppData VBS
Detects wscript.exe or cscript.exe executing a VBScript that uses MSXML2.XMLHTTP and ADODB.Stream to download a file in chunks (using the Range header) to a temporary or AppData location. This technique is often used by malware to evade detection by downloading payloads in smaller pieces.
Sigma
